CVE-2020-8655: EyesOfNetwork sudoers misconfiguration allows apache-to-root privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw yields root compromise, is in CISA KEV, and has very high EPSS, but requires local access and user interaction rather than being remotely exploitable without prerequisites.

What it is

EyesOfNetwork 5.3 ships a sudoers configuration that lets the apache user run arbitrary commands as root through a crafted NSE script for nmap 7. Because the web server account can reach root, any compromise of the web tier becomes full host compromise. The flaw is an improper privilege management issue (CWE-269).

Impact

An attacker who can influence the nmap NSE script content gains root-level command execution on the EyesOfNetwork host, leading to full control of the monitoring server and any credentials or data it holds.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker needs a way to place or trigger the crafted NSE script, typically through the web-facing application that runs as apache. No pre-existing authenticated access is required by the CVSS vector, but the description implies the apache user context is the entry point.

Exploitation

CVE-2020-8655 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.60075 (99th percentile), and public exploit references are tagged Exploit, indicating active exploitation is expected. No ransomware campaign use is documented.

What to do

• Apply the vendor update for EyesOfNetwork per CISA KEV required action; patch is the first step.
• Review and harden the sudoers configuration so the apache user cannot run nmap or arbitrary commands as root.
• Restrict or disable the nmap NSE script functionality reachable from the web interface until patched.
• Run the EyesOfNetwork web service under a least-privilege account and isolate it from root-capable tooling.
• Monitor for unexpected sudo invocations by the apache user and for nmap processes spawning shells.

Detection

• Alert on sudo or su events where the invoking user is apache and the target is root.
• Hunt for nmap processes with NSE script arguments that spawn shells or write to system paths.
• Monitor web application logs for uploads or inputs that place NSE scripts into nmap script directories.
• Watch for child processes of the web server (apache) executing system utilities unexpectedly.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.